2026-08-25_e9f67ca83eff0311b41403c8d71c6b30_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_e9f67ca83eff0311b41403c8d71c6b30_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 825KB
Sample260826-elsyzsgl5y
SHA256 628e9a039cffa916a791af0bfad36292662b3c24bf82d29d64babcbc36bd069c
MD5 e9f67ca83eff0311b41403c8d71c6b30
SHA1 1f38031cafe7e4a95a79204f2f2733d84b00bf56
SHA512 33ed14685a4fd52a378af9d9d633eb1888f8f8dc57b7740187486fc558a0e32cece62613fbbee7f68b3ef1699973d64988636274469735c50f0c75ae39513f1b
SSDEEP 12288:3LQxPFmN83FUHROHsN45v9XOIw9cd6oniose:3LQmoFUsHsYV+IwJonih
TLSH
T1A7059D49F2E800F9E0B79535D5A5661BD63278160B209BCF13D409A93F737E05BBBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_e9f67ca83eff0311b41403c8d71c6b30_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-25_e9f67ca83eff0311b41403c8d71c6b30_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 825KB

2026-08-25_e9f67ca83eff0311b41403c8d71c6b30_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH d9b43c5d66b4d4b65ce2d97d37aaba6d
SHA256 628e9a039cffa916a791af0bfad36292662b3c24bf82d29d64babcbc36bd069c
MD5 e9f67ca83eff0311b41403c8d71c6b30
SHA1 1f38031cafe7e4a95a79204f2f2733d84b00bf56
SHA512 33ed14685a4fd52a378af9d9d633eb1888f8f8dc57b7740187486fc558a0e32cece62613fbbee7f68b3ef1699973d64988636274469735c50f0c75ae39513f1b
SSDEEP 12288:3LQxPFmN83FUHROHsN45v9XOIw9cd6oniose:3LQmoFUsHsYV+IwJonih
TLSH
T1A7059D49F2E800F9E0B79535D5A5661BD63278160B209BCF13D409A93F737E05BBBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

389264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse GetDeviceCaps GetDIBits GetStockObject LineTo SelectObject GetObjectW MoveToEx

user32

TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetProcessDPIAware FillRect MessageBoxA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow GetSystemMetrics SendInput GetAsyncKeyState SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow

winmm

timeEndPeriod timeBeginPeriod

advapi32

GetUserNameA

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc CreatePipe ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileAttributesExW GetExitCodeProcess WaitForSingleObject OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree CreateProcessW DuplicateHandle WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle FreeLibraryAndExitThread ExitThread SetEnvironmentVariableW GetProcessHeap CreateFileA GetFileAttributesA GetFileSize ReadFile WriteFile GetTempPathA Beep SetStdHandle Sleep GetCurrentThread SetThreadPriority GetTickCount FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryA GetConsoleWindow DeleteFileA GetCurrentProcess TerminateProcess WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA GetCurrentThreadId InitializeCriticalSectionEx RtlUnwind GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead CreateThread HeapSize CreateFileW SetEndOfFile CloseHandle RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

Name

.text

Size

592KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_e9f67ca83eff0311b41403c8d71c6b30_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

gdi32

user32

winmm

advapi32

kernel32

imm32

generic